Ukukhutshwa kwe-Snuffleupagus 0.5.1, imodyuli yokuthintela ubuthathaka kwizicelo ze-PHP

Emva konyaka wophuhliso ipapashiwe ukukhutshwa kweprojekthi I-Snuffleupagus 0.5.1, ebonelela ngemodyuli yetoliki ye-PHP7 ukuphucula ukhuseleko lokusingqongileyo kunye nokuthintela iimpazamo eziqhelekileyo ezikhokelela kubuthathaka ekusebenziseni izicelo ze-PHP. Imodyuli ikwavumela ukuba wenze iipetshi ezibonakalayo ukuphelisa iingxaki ezithile ngaphandle kokutshintsha ikhowudi yomthombo wesicelo esisengozini, ekulungele ukusetyenziswa kwiinkqubo zokubamba ngobuninzi apho kungenakwenzeka ukugcina zonke izicelo zomsebenzisi zihlaziyiwe. Iindleko eziphezulu zemodyuli ziqikelelwa ukuba zincinci. Imodyuli ibhaliwe kwi-C, idibaniswe ngendlela yelayibrari ekwabelwana ngayo ("extension=snuffleupagus.so" kwi php.ini) kunye isasazwa ngu inikwe ilayisenisi phantsi kwe-LGPL 3.0.

I-Snuffleupagus inikezela ngenkqubo yemithetho evumela ukuba usebenzise iitemplates eziqhelekileyo ukuphucula ukhuseleko, okanye udale imithetho yakho yokulawula idatha yokufaka kunye neeparitha zokusebenza. Umzekelo, umgaqo othi “sp.disable_function.function(“system”).param(“command”).value_r(“[$|;&`\\n]”).drop();” ikuvumela ukuba unciphise usebenziso lweempawu ezikhethekileyo kwindlela () iimpikiswano zomsebenzi ngaphandle kokutshintsha isicelo. Iindlela ezakhelwe ngaphakathi zibonelelwa ukubhloka iiklasi zobuthathaka njengemiba, ezinxulumene ngolandelelwano lwedatha, engakhuselekanga ukusetyenziswa kweposi ye-PHP () umsebenzi, ukuvuza kwemixholo yeCookie ngexesha lohlaselo lwe-XSS, iingxaki ngenxa yokulayisha iifayile ngekhowudi ephunyeziweyo (umzekelo, kwifomathi phar), umgangatho ombi wokwenza amanani random kunye endaweni Ulwakhiwo olungalunganga lwe-XML.

Iindlela zokuphucula ukhuseleko lwe-PHP ezibonelelwa nguSnuffleupagus:

• Yenza ngokuzenzekelayo iiflegi "ezikhuselekileyo" kunye "nesamesite" (ukhuseleko lweCSRF) kwiiKuki, ufihlo i-cookie;
• Isethi yemithetho eyakhelwe-ngaphakathi ukuchonga imikhondo yokuhlaselwa kunye nokuthotyelwa kwezicelo;
• Ukunyanzeliswa kusebenze kwihlabathi jikelele "ngqongqo" (umzekelo, ibhloka inzame yokuchaza umtya xa ulindele ixabiso elipheleleyo njengempikiswano) kunye nokhuseleko ngokuchaseneyo. uhlobo lokukhohlisa;
• Ukuvala ngokungagqibekanga iprotocol wrappers (umzekelo, ukuvalwa "phar://") ngoluhlu lwabo olumhlophe olucacileyo;
• Ukuthintelwa kokusetyenziswa kweefayile ezibhaliweyo;
• Uluhlu olumnyama nolumhlophe lwe-eval;
• Kuyafuneka ukuze kukhangelwe isatifikethi se-TLS xa usebenzisa
  umjikelo
• Ukongeza i-HMAC kwizinto ezilandelelanayo zokuqinisekisa ukuba i-deserialization ifumana kwakhona idatha egcinwe sisicelo sokuqala;
• Imo yesicelo sokuloga;
• Ukuthintela ukulayishwa kweefayile zangaphandle kwi-libxml ngokusebenzisa amakhonkco kumaxwebhu e-XML;
• Ukukwazi ukudibanisa abaphathi bangaphandle (upload_validation) ukujonga kunye nokuskena iifayile ezilayishiwe;

Phakathi utshintsho kukhupho olutsha: Inkxaso ephuculweyo ye-PHP 7.4 kunye nokuzalisekiswa kokuhambelana kunye nesebe le-PHP 8 ekuphuhlisweni ngoku.Ukongeza amandla okungena kwimicimbi nge-syslog (i-sp.log_media Directive indululwa ukuba ibandakanywe, engathatha iphp okanye ixabiso le-syslog). Isethi engagqibekanga yemithetho ihlaziywe ukubandakanya imithetho emitsha yobuthathaka obuchongiweyo obutsha kunye neendlela zokuhlasela ngokuchasene nezicelo zewebhu. Inkxaso ephuculweyo ye-macOS kunye nokusetyenziswa okwandisiweyo kweqonga lokudibanisa eliqhubekayo esekwe kwiGitLab.

umthombo: opennet.ru